PRIVACY POLICY.

Effective date: 18 September 2026

LOOP RUSH is operated by Indigloo Softwares Private Limited (“Indigloo”, “we”, “us”). This policy explains how the LOOP RUSH web game handles personal data. Practice play does not require an account.

1. Information we process

• Account information: email address, display name, password hash, email-verification state, and account creation time.
• Security information: session identifiers, password-reset and verification records, encrypted authenticator setup data, hashed recovery codes, and App Check attestation results.
• Game information: ranked runs, answers and tap timing, scores, leaderboard entries, room membership, readiness, and co-play answers.
• Chat information: your display name, message text, room identifier, user identifier, and message time when Firebase room chat is enabled.
• Technical information: IP address for short-lived security rate limits and browser or device integrity signals processed through Firebase App Check and reCAPTCHA Enterprise when enabled.
• Device-only information: practice records and preferences are stored in your browser’s local storage. They are not added to online leaderboards unless you deliberately start and complete a ranked run.

2. Why we use it

We use this information to create and secure accounts, verify email addresses, provide password recovery and optional MFA, operate ranked games and co-play rooms, display high scores, deliver room chat, prevent abuse, investigate failures, and respond to privacy or support requests. We do not sell personal data and do not use LOOP RUSH data for targeted advertising.

3. Information visible to other players

Your display name and scores can appear on leaderboards. Room members can see your display name, readiness, score, and messages you send. Your email address, password information, MFA data, and IP address are not shown to other players. Room invite links should be shared only with people you intend to invite.

4. Service providers

We use service providers only to operate and protect the game:

• Microsoft Azure for application hosting and infrastructure.
• Google Firebase for optional room chat and App Check. Web App Check uses reCAPTCHA Enterprise; Android and iOS builds may use platform integrity providers.
• Resend for verification, password-reset, and security emails.

These providers may process limited technical or account information under their own data-processing and retention terms. Depending on provider configuration, data may be processed outside your state or country. We may also disclose information when required by applicable law or to protect users, the service, or our legal rights.

5. Cookies and local storage

Signed-in sessions use an essential, secure HTTP-only cookie named lr_session. It is not used for advertising. Browser local storage holds practice records and preferences. You can remove local records by clearing site data in your browser; doing so does not delete an online account.

6. Retention

Authorized administrators can review player details, scores, rooms and abuse reports. Reports store the reporting player identifier, room and message identifiers, your reason and review status. Moderation audit records store administrator identifiers, actions, targets, reasons and timestamps. Reports and audit records may remain after account deletion for abuse investigation, and are removed by scheduled cleanup after 90 days. Avoid including sensitive personal information in report reasons.

• Account details and leaderboard scores remain while the account is active, unless deletion is requested.
• Sessions expire after seven days. Password-reset links expire after 30 minutes, verification links after 24 hours, and login MFA challenges after five minutes.
• Unfinished ranked-run records are removed by scheduled cleanup after 24 hours. Rooms expire after 24 hours and are removed by scheduled cleanup.
• Security rate-limit records are short-lived. Queued email records are deleted after successful delivery or scheduled cleanup; delivered email can remain with the sender’s and recipient’s email providers.
• Firebase chat data is queued for deletion when an account or empty room is deleted. Temporary provider copies and infrastructure logs may remain under the relevant provider’s retention rules.

The current application does not promise a separate archival copy of your game data. If our backup or retention practices materially change, we will update this policy before relying on the new practice.

7. Your choices and rights

You may play practice modes without creating an account. You may request access, correction, or deletion of your personal data by contacting us. Signed-in users can permanently delete their account from the Account page. The same deletion flow is available from our public account-deletion page. Deletion removes live account data, security credentials, online scores, runs, room participation, and queued account emails; shared rooms and other players’ data remain.

8. Security

We use HTTPS, hashed passwords and session tokens, encrypted MFA secrets and queued email content, access controls, request limits, server-side score validation, and optional Firebase App Check. No online system is completely secure, so please use a unique password and keep recovery codes private.

9. Children

LOOP RUSH online account and chat features are not intended for children under 18. A child should not create an account or use chat without involvement and consent from a parent or legal guardian where required. A parent or guardian who believes a child submitted personal data can contact us to request deletion.

10. Changes

We may update this policy when features, providers, or legal requirements change. We will publish the new effective date here and provide additional notice when a change materially affects how personal data is used.

11. Contact and grievances

For privacy questions, access or correction requests, grievances, or deletion assistance, contact:

Include “LOOP RUSH Privacy” in the subject line. We may ask for reasonable verification before acting on an account-specific request.